Add ability to load test remote Yara config #25220
Labels
#g-orchestration
Orchestration product group
:release
Ready to write code. Scheduled in a release. See "Making changes" in handbook.
From the parent ticket:
The plan here is to update the
runLiveQuery
implementation so that it branches based on the contents of the live request. If it's determined to be a request for a Yara scan with a remote rule (i.e. it has "FROM yara" and "sigurl" in it) then we'll do the appropriate request to the Fleet instance to get the rule, and send a mock YARA response. Otherwise we'll send the regular mock response. Updating therunLiveQuery
code means we can take advantage of the existing options around simulating failure and empty result sets.The text was updated successfully, but these errors were encountered: